Accessibility requirements: does the law apply to your online shop?

This probably does not apply. Accessibility requirements came into force in Finland on 28 June 2025, and online shops are explicitly mentioned in the Act — but micro-enterprises are excluded from the Act, and a standard showcase website does not fall within its scope at all. In practice, the vast majority of Finnish small businesses fall outside the scope of both these restrictions. This article explains how to check for yourself what the law requires of those it does apply to, and how enforcement actually works.

Two questions that settle the matter

The issue has been blown out of proportion because it is being discussed as if it applied to all websites. It does not. The law applies to specific services, and even then it excludes the smallest businesses. Both of these restrictions are independent: either one is sufficient.

Question 1: Do you sell online?

The law defines an online shop as follows: “an electronic shop on a website or in a mobile app where a consumer can enter into contracts remotely to purchase services or products”. The decisive factor is therefore whether a contract is formed on the site.

If a website provides information about services and asks visitors to call or fill in a quote request form, no transaction takes place on the site. Such a website is not an online shop within the meaning of this Act. The same applies to a restaurant’s website that features a menu but does not accept orders, and a construction company’s website that lists references and contact details.

In addition to online shops, the law applies to certain sectors regardless of whether anything is sold on the website. These are:

• banks, credit institutions, investment firms, insurance companies and insurance associations
• service providers in the water and energy sectors
• transport and postal service providers
• passenger transport services: rail, coach, underground and tram services
• e-books and related services
• audiovisual content services and communication services

If your business isn’t on this list and no sales are made via your website, this law does not apply to your site. You can stop reading here — or skip to the final section, which explains why it’s still worth meeting some of the requirements.

Question 2: Are you a micro-enterprise?

Even if you sell online, the law does not impose any obligations on micro-enterprises. The threshold is as follows:

Terms and conditions	Raja	How is it calculated?
Staff	fewer than 10 employees	This condition must be met
Turnover	up to €2 million	It is sufficient for one of these to be met
Balance sheet total	up to €2 million

It is worth reading the terms and conditions carefully, as this is precisely where things often go wrong: the staff limit is mandatory, and, in addition, it is sufficient for either the turnover or the balance sheet total to be two million. A three-person company with a turnover of 300,000 euros is a micro-enterprise by all measures. A twelve-person company is not a micro-enterprise, even if its turnover is small.

If your business is close to the threshold or growing beyond it, check with Traficom rather than relying on this article. The thresholds are clear-cut, but how your own business fits into them — part-time staff, group structure, length of the financial year — is not always so straightforward.

What the law requires, if it applies to you

This requirement is neither a matter of opinion nor a matter of taste. It is a defined standard: the A and AA level criteria of the WCAG 2.1 guidelines, totalling 49 mandatory points. The law does not require AAA level compliance, although this is sometimes offered.

Most of the criteria are technical and can be rectified once. In practice, these five are the most crucial:

Criterion	What does it take?
1.1.1 Text equivalents	Every image has a text equivalent. Decorative images are marked as such
1.4.1 Use of colour	Information must not be based solely on colour. ‘Red fields are mandatory’ is not enough
1.4.3 Contrast	Contrast ratio between text and background of at least 4.5:1 for small text
2.1.1 Keyboard	It must be possible to carry out all functions using the keyboard. This includes the checkout
1.4.10 Responsiveness	The page is 320 pixels wide and does not require horizontal scrolling

An online shop also requires two things that have nothing to do with the technical aspects of the website:

• Accessibility statement. An online shop must include a statement describing the service, specifying which devices or software are required to use it, and explaining how the service-specific requirements have been met.
• Accessibility information for products. If you sell products for which the manufacturer or importer has provided information on the product’s accessibility, this information must be passed on in your online shop. You do not need to produce the information yourself — simply pass it on if it is available.

The law also provides for an ‘unreasonable burden’ exception. This is not a free pass: invoking it requires a formal assessment to be carried out and documentation to be retained for five years. In practice, invoking the exemption is usually more labour-intensive than meeting the requirements.

Existing contracts may continue until 2030

This point is almost always left out. If a service agreement was entered into before 28 June 2025, it may continue as it stands until the end of the contract period — but no later than 28 June 2030. After that, the agreement cannot be extended if it does not comply with the requirements.

Content archived before 28 June 2025, recordings published prior to that date and office software files published before then are also excluded from the requirements.

How does monitoring actually work?

This is where the sales pitch and reality differ the most.

Supervisory responsibility was transferred from the Regional State Administrative Agency to Traficom in January 2025. Traficom supervises digital services in both the public and private sectors. It has the right to impose a penalty payment — but the authority itself describes this as a measure of last resort.

Nor does monitoring begin simply because the authorities browse through online shops. It is triggered by a complaint or a request for clarification: a user reports a shortcoming. The first step is administrative guidance. An order and a potential fine are only imposed if the guidance proves ineffective.

The volume of planned inspections is public: around 20 comprehensive inspections and around 240 light inspections per year, and the number of businesses inspected is linked to the population, in accordance with the European Commission’s calculation method. There are many times that number of Finnish online shops.

You shouldn’t jump to the conclusion that the requirements can be ignored. Anyone can lodge a complaint, and the complaint will come from precisely the customer who was unable to make a purchase. But there is a fundamental difference: this is not about an inspection round due to take place next month. The sense of urgency with which accessibility audits are currently being marketed is not based on the nature of regulatory oversight.

Four claims that aren’t true

Claim	How does it work?
“The law applies to all websites”	Applies to the online shop and the listed sectors. The showcase website is not covered
“A must even for small businesses”	Companies with fewer than 10 employees and a turnover or balance sheet total of no more than €2 million are excluded
“Fines are imposed immediately”	Enforcement stems from a complaint; guidance comes first; a penalty payment is a last resort
“We need AAA standard”	The law requires A and AA levels, comprising 49 criteria. AAA is not a requirement

Is it worth doing, even if the law doesn’t apply?

Some are worth it, some aren’t. We do not recommend purchasing a full WCAG audit for a company that is not subject to the legislation — that’s money that would be better spent elsewhere. However, five of the 49 points are worth addressing in any case, as they are also common usability issues and affect all customers, not just those who use assistive technology:

• Contrast. Grey text on a light background is difficult to read even for those with good eyesight, and particularly difficult on a mobile phone outdoors.
• Form field names. Without them, the browser’s autofill function won’t work. This isn’t an accessibility issue but a matter of completing the checkout process.
• Keyboard operation. If you cannot proceed through the checkout using the keyboard, there are almost certainly other faults as well.
• Text descriptions for images. The same text that search engines read and that is also visible when an image fails to load.
• 320 pixels wide. If the page requires horizontal scrolling on a small mobile phone, some customers will leave before they see the product.

These five can be done in a day or two for an existing website; they’re not part of an audit project. The remaining 44 criteria are worth addressing when required by law — or when the website is being redesigned anyway, in which case they cost next to nothing on their own.

In demand

Does the law apply to a website that doesn’t sell anything?

No, unless the business operates in a sector listed in the Act (finance, insurance, water and energy, transport, postal services, e-books, audiovisual services, communications services). A standard showcase website that describes services and invites visitors to get in touch is not an online shop within the meaning of the law, as no contract is formed on the site.

How do I know if my business is a micro-enterprise?

The company must have fewer than 10 employees, and either its turnover or its balance sheet total must not exceed 2 million euros. The staff requirement is mandatory; only one of the financial criteria needs to be met. If your business is close to the limit, check with Traficom — the thresholds are clear, but it is not always clear how your own business fits within them.

What happens if the requirements aren’t met?

Enforcement proceedings are initiated following a user complaint or a request for clarification, not on the authority’s own initiative. The first step is administrative guidance. If such guidance does not lead to rectification, Traficom may issue an order and, as a last resort, impose a conditional fine. Traficom itself describes the conditional fine as a measure of last resort, and the amount is determined on a case-by-case basis.

Is an automated accessibility tool enough?

Not on its own. An automated test detects some of the criteria — such as missing text alternatives and insufficient contrast — but not, for example, whether a text alternative is meaningful or whether the reading order of the page is logical. ‘Accessibility buttons’ that can be embedded in a website, which promise to fix the site with a single script, do not make the site compliant with the requirements.

Does the old online shop need to be completely rebuilt?

Not automatically. Most of the 49 criteria can be rectified on an existing website. A complete overhaul is only necessary if the underlying structure is such that it cannot be brought up to standard with a reasonable amount of work — typically an old page builder where the source code is inaccessible. Which scenario applies can be determined by checking, not by guessing. If a complete overhaul is required, the costs per platform are set out in the article ‘WooCommerce or Shopify: the cost of an online shop in Finland’.